nodejs/node
Runtime-deprecate calling digest() on HMAC more than once
Fermée
#62 838 ouverte le 20 avr. 2026
cryptogood first issuesecurity
Métriques du dépôt
- Stars
- (117 218 étoiles)
- Métriques de merge PR
- (Merge moyen 18j 17h) (219 PRs mergées en 30 j)
Description
(Upd: detected by the scanner behind @deepview-autofix)
Hash behavior is reasonable:
> hash = require('crypto').createHash('sha256').update('data')
> hash.digest()
<Buffer 3a 6e b0 79 0f 39 ac 87 c9 4f 38 56 b2 dd 2c 5d 11 0e 68 11 60 22 61 a9 a9 23 d3 bb 23 ad c8 b7>
> hash.digest()
Uncaught Error [ERR_CRYPTO_HASH_FINALIZED]: Digest already called
at Hash.digest (node:internal/crypto/hash:155:11) {
code: 'ERR_CRYPTO_HASH_FINALIZED'
}
But HMAC, on the other hand, returns empty buffers on further .digest() calls, likely for compat reasons:
> hmac = require('crypto').createHmac('sha256', 'key').update('data')
> hmac.digest()
<Buffer 50 31 fe 3d 98 9c 6d 15 37 a0 13 fa 6e 73 9d a2 34 63 fd ae c3 b7 01 37 d8 28 e3 6a ce 22 1b d0>
> hmac.digest()
<Buffer >
This is a footgun with potential security risks, and should be first runtime-deprecated, then removed if no breakage is detected.